oauth

Dynamic Client Registration (RFC 7591)

Register an OAuth 2.0 client programmatically. Returns a client_id (GUID) and, for confidential clients, a client_secret.

Public vs. confidential clients

  • Public clients (token_endpoint_auth_method: "none"): Must use PKCE (S256) for all authorization requests. No client_secret is issued.
  • Confidential clients (token_endpoint_auth_method: "client_secret_basic"): Receive a client_secret for HTTP Basic authentication. The secret is only returned once at registration time.

Rate limiting

This endpoint is rate limited. Exceeding the limit returns 429 Too Many Requests.

See the OAuth for AI & Third-Party Clients guide for full details.

post/oauth/register

Request

  • Base URL: https://docs-api.formify.eu/v1
  • URL: https://docs-api.formify.eu/v1/oauth/register
  • Auth: none required

Request body

client_namestring required

Human-readable name shown to users during authorization.

redirect_urisstring[] required

Array of allowed callback URLs. Must be absolute HTTPS URLs without fragments.

token_endpoint_auth_method'none' | 'client_secret_basic'

"none" for public clients, "client_secret_basic" for confidential clients.

grant_typesstring[]

Informational. Array of grant types the client intends to use.

response_typesstring[]

Array of response types. Only "code" is supported.

client_uristring

URL to the application's homepage.

logo_uristring

URL to the application's logo, displayed during authorization consent.

tos_uristring

Link to Terms of Service.

policy_uristring

Link to Privacy Policy.

scopestring

Space-separated list of scopes the client intends to request.

contactsstring[]

Array of contact email addresses.

Response

Client registered successfully.

client_idstring

The registered client identifier (GUID).

client_namestring

The registered client name.

redirect_urisstring[]

The registered redirect URIs.

grant_typesstring[]

The registered grant types.

response_typesstring[]

The registered response types.

token_endpoint_auth_methodstring

"none" or "client_secret_basic".

client_id_issued_atinteger

Unix timestamp when the client was registered.

client_secretstring

Only for confidential clients. The client secret.

client_secret_expires_atinteger

Only for confidential clients. 0 means no expiration.

Changes

No recorded changes to this operation across all 1 revision of this API.